Windows PowerShell access to browser credential database files

title: Windows PowerShell access to browser credential database files
id: e6c922a5-2d4b-487d-9ec2-e03714a833e5
related:
  - id: 98f4c75c-3089-44f3-b733-b327b9cd9c9d
    type: obsolete
  - id: 47147b5b-9e17-4d76-b8d2-7bac24c5ce1b
    type: similar
  - id: fc028194-969d-4122-8abe-0470d5b8f12f
    type: derived
status: test
description: This rule identifies PowerShell script block activity that copies browser login database files, such as Chrome, Edge, Firefox, and Opera Login Data, from their profile paths. Attackers may use these files to obtain saved website usernames and passwords, which can enable further credential access. It relies on Windows PowerShell script block text telemetry to match Copy-Item usage alongside specific browser credential-store paths.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1555.003/T1555.003.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/powershell/powershell_script/posh_ps_access_to_browser_login_data.yml
author: frack113, Huntrule Team
date: 2022-01-30
tags:
  - attack.credential-access
  - attack.t1555.003
logsource:
  product: windows
  category: ps_script
  definition: "Requirements: Script Block Logging must be enabled"
detection:
  selection_cmd:
    ScriptBlockText|contains|all:
      - Copy-Item
      - -Destination
  selection_path:
    ScriptBlockText|contains:
      - \Opera Software\Opera Stable\Login Data
      - \Mozilla\Firefox\Profiles
      - \Microsoft\Edge\User Data\Default
      - \Google\Chrome\User Data\Default\Login Data
      - \Google\Chrome\User Data\Default\Login Data For Account
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1